CVE-2026-15514 Overview
CVE-2026-15514 is a SQL injection vulnerability in Metasoft (美特软件) MetaCRM through version 6.4.0 Beta06. The flaw resides in the RPCService.query function within /customizemt/xkq/rpc.jsp, part of the PHPRPC Remote Call Interface component. Attackers can manipulate the phprpc_args argument to inject arbitrary SQL statements. The attack is remotely exploitable and requires no authentication or user interaction. A public exploit is available, and the vendor did not respond to disclosure attempts. The vulnerability is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output).
Critical Impact
Unauthenticated remote attackers can inject SQL queries against MetaCRM databases through the phprpc_args parameter, exposing customer relationship data to disclosure, modification, or destruction.
Affected Products
- Metasoft (美特软件) MetaCRM versions up to and including 6.4.0 Beta06
- Component: PHPRPC Remote Call Interface (/customizemt/xkq/rpc.jsp)
- Function: RPCService.query
Discovery Timeline
- 2026-07-13 - CVE-2026-15514 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15514
Vulnerability Analysis
The vulnerability affects the PHPRPC Remote Call Interface exposed by MetaCRM through /customizemt/xkq/rpc.jsp. This endpoint accepts serialized remote procedure call payloads via the phprpc_args parameter. The RPCService.query function processes these arguments and forwards attacker-controlled content into backend SQL statements without adequate sanitization or parameterization.
Because the endpoint is network-accessible and requires no authentication, an attacker only needs the ability to reach the MetaCRM web interface. Successful exploitation allows arbitrary SQL execution in the application database context. Depending on database privileges, attackers may read sensitive CRM records, modify business data, or pivot toward broader server compromise.
The issue is classified under [CWE-74], covering improper neutralization of special elements passed to downstream components. Public disclosure includes technical writeups on VulDB and a Feishu document containing exploitation details.
Root Cause
The root cause is a failure to sanitize or parameterize input received through the phprpc_args argument before it is passed into database query construction inside RPCService.query. The PHPRPC deserialization and dispatch logic treats client-supplied strings as trusted, allowing SQL syntax to break out of intended query boundaries.
Attack Vector
Exploitation occurs over the network against the /customizemt/xkq/rpc.jsp endpoint. An attacker crafts a PHPRPC request containing a malicious phprpc_args payload with SQL syntax appended to the expected data. The application decodes the argument and concatenates it into a database query, executing the injected SQL. No credentials, session, or user interaction are required.
No verified proof-of-concept code is provided in the enriched dataset. Refer to the VulDB advisory for CVE-2026-15514 and the Feishu technical writeup for exploitation details.
Detection Methods for CVE-2026-15514
Indicators of Compromise
- HTTP POST or GET requests to /customizemt/xkq/rpc.jsp containing the phprpc_args parameter with encoded SQL keywords such as UNION, SELECT, SLEEP, WAITFOR, or comment sequences (--, /*).
- Unusual PHPRPC serialized payloads targeting the RPCService.query method from external or unexpected source IP addresses.
- Database logs showing malformed queries, syntax errors, or unexpected UNION-based reads originating from the MetaCRM application user.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect requests to /customizemt/xkq/rpc.jsp and flag SQL metacharacters within the phprpc_args value.
- Enable database query auditing on the MetaCRM backend and alert on queries containing tautologies, boolean-based patterns, or time-delay functions.
- Correlate application error logs with source IPs generating repeated malformed PHPRPC requests to identify probing activity.
Monitoring Recommendations
- Forward MetaCRM application logs, Java Server Pages (JSP) container logs, and database audit logs to a centralized analytics platform for retention and correlation.
- Alert on outbound connections from the MetaCRM host to unfamiliar destinations, which may indicate post-exploitation data exfiltration.
- Baseline normal PHPRPC traffic volume and endpoint distribution, then alert on spikes targeting rpc.jsp.
How to Mitigate CVE-2026-15514
Immediate Actions Required
- Restrict network access to /customizemt/xkq/rpc.jsp using firewall rules or reverse proxy allowlists, permitting only trusted internal clients.
- Deploy WAF signatures that block SQL injection patterns in the phprpc_args parameter of PHPRPC endpoints.
- Review database logs and MetaCRM access logs for evidence of prior exploitation attempts against the affected function.
- Rotate database credentials used by MetaCRM if suspicious activity is identified.
Patch Information
No vendor patch is available at the time of publication. According to the disclosure, Metasoft did not respond to the researcher's early notification. Organizations running MetaCRM 6.4.0 Beta06 or earlier should track vendor communications and apply an official fix as soon as one is published. Consult the VulDB entry for CVE-2026-15514 for updated remediation status.
Workarounds
- Disable the PHPRPC Remote Call Interface if it is not required for business operations by removing or restricting access to /customizemt/xkq/rpc.jsp.
- Enforce least-privilege database accounts for the MetaCRM application to limit the impact of successful SQL injection.
- Place MetaCRM behind an authenticating reverse proxy so unauthenticated internet users cannot reach the vulnerable endpoint.
- Implement input validation at a proxy layer that rejects phprpc_args values containing SQL syntax until an official patch is released.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
